Information Security Officer

Position Title:
Information Security Officer

Department:
Information Security

Reports To:
Chief Operating Officer

Hours: 8:00 – 5:00, ET (core)

Location:
Cornelius, North Carolina or Lincoln, Nebraska

Compensation:
Salary + Bonus

The Information Security (IS) Officer owns Infovisa’s information security program including designing, implementing, and monitoring the controls that protect the enterprise while enabling the business to operate and thrive. As the company’s designated security leader, this person is accountable not only for identifying risk but for closing it. Working closely with company management and the IT team, the IS Officer sets security standards and policy, personally operates the company’s core security tooling, and provides independent oversight of the security-related work carried out by IT.

The role operates under GLBA and SOC 2 obligations and has primary responsibility for the company’s information security program.

The person in this position works across the following areas and technologies:
Network Security;
Enterprise Firewalls (Check Point, Check Point Harmony VPN); AWS cloud security;
Endpoint Detection and Response (Crowd Strike);
Security Information and Event Management (Sophos);
Vulnerability Management;
Identity and Access Management (Entra );
Windows Server, Hyper-V, and IIS; TLS certificate management and PKI; DNS; and the application infrastructure of the enterprise network.

• Program ownership: own the information security program including strategy, policies, standards, and their day-to-day execution; accountable for closing findings.
• Executive reporting: serve as the company’s designated security owner under GLBA; report the state of security risk and remediation directly to executive management in terms of threat level and associated risk.
• Security monitoring & detection: operate and maintain the enterprise security monitoring and log-management capability; define data inputs and alerting, monitor for threats, and respond to events.
• Endpoint & threat protection: manage endpoint detection and response and related malware protection across the environment.
• Vulnerability, patch & hardening: own the vulnerability management lifecycle from identification through verified remediation, and set patch-management and system-hardening standards for servers and databases, monitoring compliance.
• Firewall policy & oversight: define and maintain the firewall change policy and security configuration standards; oversee execution through formal change control; review higher-risk and datacenter firewall changes prior to implementation.
• Identity & access: set identity and access-management standards and own periodic access reviews, including timely removal of access for separated associates.
• Incident response: lead security incident response through detection, containment, remediation, and post-incident review.
• Policy, documentation & compliance: develop, maintain, and enforce security policies and procedures; own the written information security program required under GLBA and the control evidence required for SOC 2; coordinate SOC 2 readiness and act as the primary internal owner for security control evidence.
• Audits, examinations & testing: participate in external audits, third-party vulnerability scans and penetration tests, and regulatory examinations including gathering artifacts and attending interviews.
• Vendor risk: conduct third-party/vendor security reviews and manage security vendor relationships.
• Awareness training: manage cybersecurity awareness training for all associates.
• Team leadership: hire, train, mentor, and manage associate(s) on the security team; provide security direction to IT staff who execute security-related changes.
• Ind…